[harenome]

Closes #41

What

A licence server's forwarder joins the unit's internal network under the server's own name. It resolved that name for each connection, and the network's DNS answered with the forwarder itself, so the agent got a closed connection. The forwarder now resolves the name once, before it listens, and keeps every address. Each connection tries the addresses in order and skips an address family that the machine does not have. A name that does not resolve ends the forwarder with an unresolved event. Unit._forward waits for listening before network connect, so the lookup happens before the name becomes the forwarder's. A Unix socket target (the MCP door) is unchanged.

Touches

the standard · backend

• app/nullius/standard/forward.py, container.Unit._forward
• tests: app/tests/test_standard_forward.py (new), app/tests/test_standard_container.py

Verified

The reproduction, on main and on this branch:

• Rootful Docker 29.9.3 runs in a docker:dind container on a podman network with DNS.
• A greeting server (LICENSE-OK) runs in a second podman container on that network, named nullius-licence-server.
• Docker's default bridge has no embedded DNS. Its containers use the dind's resolver, which is podman's network resolver, so the forwarder resolves the server's name there.
• Unit._forward(1, "nullius-licence-server:27001") runs from the source. An agent container on the unit's network connects to the address that it returns.

main:

forwarder log: {"event": "listening", "port": 27001}
in the forwarder, the name now resolves to 172.18.0.2 ; its own addresses: 172.17.0.2 172.18.0.2
agent: nullius-licence-server -> closed, no greeting

This branch:

forwarder log: {"event": "listening", "port": 27001}
in the forwarder, the name now resolves to 172.18.0.2 ; its own addresses: 172.17.0.2 172.18.0.2
agent: nullius-licence-server -> LICENSE-OK

• Backend suite: 1609 tests in 103 modules: OK. Route suite: 262 tests in 35 modules: OK. Both ran in a rootless podman container capped at 4 CPUs.
• test_standard_forward and test_a_licence_forwarder_listens_before_it_takes_the_servers_name: 10 runs in that container, all OK.
• The docker tier does not cover this. It uses only host.docker.internal, which --add-host pins. Docker's default bridge has no embedded DNS, so a tier test cannot give a server a name there. The check above was made by hand.

Risk

• A licence server that changes its address during a unit is not followed: the forwarder keeps the addresses it resolved at start. The next unit resolves again.
• If the server's name does not resolve where the forwarder runs, the unit now fails at start with the unresolved event. Before, it failed at the first connection.
• The lookup now happens inside the 30 s wait for listening. A very slow resolver fails the unit with "did not listen in 30 s", not with unresolved.
• Undo: revert the commit.